This is a simple static unpacker for any RCryptor v1.1, v1.3, v1.3b, v1.4, v1.5, v1.6, v1.6b, v1.6c or 1.6d encrypted file, and may work with other versions too. A couple of unknown versions are unpacked also ..
A static unpacker does not run the file when unpacking, so is safe to use on dodgy files..
Usage:
Simply load the file you want to unpack into PEiD, then select the plugin from the menu.
Or, for console Exe version, type UnRCrypt PackedFile.EXE at command prompt.. (or drop file onto unpacker icon)
The file will be checked to see if it is any of the supported versions - and if signature found, then it is unpacked.
Note : The original file is overwritten.
If anyone has any other versions of this encryptor, please send to BobSoft@GMail.COM ..
o Static unpacking ..
o Simple to use..
o Very fast ..!
o Unpacks multiple versions ..
o Removes added RCryptor section ..
Version 1.00 - 09-May-2007
o Unpacks any file encrypted by RCryptor v1.6d ..
Version 1.01 - 22-May-2007
o Unpacks any file encrypted by RCryptor v1.5 ..
o Unpacks any file encrypted by RCryptor v1.6c ..
o Added Exe version of unpacker ..
Version 1.02 - 14-Jul-2007
o Added unpack code for RCryptor v1.1, v1.3, v1.3b, v1.4, v1.5 + v1.6b ..
Version 1.03 - 28-Jul-2007
o Added unpack code for RCryptor v1.6, and 2 unknown versions ..
[RCryptor v1.?? -> Vaska]
signature = 90 58 90 50 90 8B 00 90 3C 50 90 58 0F 85 67 D6 EF 11 50 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3
ep_only = true
[RCryptor v1.1 --> Vaska]
signature = 8B 04 24 83 E8 4F 68 ?? ?? ?? ?? FF D0 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3
ep_only = false
[RCryptor v1.3 / v1.4 --> Vaska]
signature = 55 8B EC 8B 44 24 04 83 E8 4F 68 ?? ?? ?? ?? FF D0 58 59 50 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3
ep_only = true
[RCryptor v1.3b --> Vaska]
signature = 61 83 EF 4F 60 68 ?? ?? ?? ?? FF D7 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3
ep_only = true
[RCryptor v1.5 (Private) --> Vaska]
signature = 83 2C 24 4F 68 ?? ?? ?? ?? FF 54 24 04 83 44 24 04 4F B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3
ep_only = true
[RCryptor v1.6 -> Vaska]
signature = 33 D0 68 ?? ?? ?? ?? FF D2 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3
ep_only = true
[RCryptor v1.6b / v1.6c --> Vaska]
signature = 8B C7 03 04 24 2B C7 80 38 50 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3
ep_only = true
[RCryptor v1.6d --> Vaska]
signature = 60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 90 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3
ep_only = true
[RCryptor v1.6x --> Vaska]
signature = 60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? C3
ep_only = true
Just add these to your UserDB.TXT to detect RCryptor files..
Thanks to sowhat-x for supplying most versions of RCryptor for testing!
Also big thanks to Pedro / Panda Software for sending me some test files!
Greets to: sowhat-x, snaker, Jibz & Qwerton, Jupiter, BuLLeT, Jeremy Collake, _pusher_, dila, mr Haggar, Fly and all peeps on
PEiD forum
Comments? Bugs? You look like Jessica Alba? ;) Email : BobSoft@GMail.com
For more plugins see my plugins site - Hosted by BuLLeT (Thanks!)
Thanks again to whoever invented coffee, without which I would never get anything done.. ;)
~ A program without bugs has either too few users, or too few uses ~